Funny, I thought that Copilot was for entertainment purposes only
Microsoft Copilot Cowork Exfiltrates Files
41–50 of 58 posts
Re: Microsoft Copilot Cowork Exfiltrates Files
#42what’s the recommended for scenarios like this? Add a skill scanner that admins can configure?
Re: Microsoft Copilot Cowork Exfiltrates Files
#43It's not the first time we hear about prompt injection attacks, and for sure it's the fault of Microsoft. Many talking about the prompt injection itself, whether Copilot should be able to defense prompt injections, etc. But that's not the problem. OpenAI released their LLM-driven browser Atlas last year. Though their team is brilliant ( https://openai.com/index/hardening-atlas-against-prompt-inje... ), there has been…
The problem is natural language as a medium. It is too ambiguous and has way too many variants to say literally anything imaginable that there is no way of protecting against prompt injection without some kind of NLP filter or something. I don't really see how someone can develop a kind of protection against this given these problems.
Re: Microsoft Copilot Cowork Exfiltrates Files
#44[dead]
Re: Microsoft Copilot Cowork Exfiltrates Files
#45Exfiltrates: to steal sensitive data from a computer system (for example, via a flash drive). I'm not going to defend Microsoft here, but the title (at the source blog) is misleading and a bit rage-baity. What happened with Cowork may have been rushed, possibly due to incompetence, but incompetence is not malice. This framing is also recycled across a few of the author's other interesting findings. Within the article…
> Within the article, the wording is much more accurate: “The victim uploads a skill file to Copilot Cowork that contains a prompt injection,” and “The injection manipulates Microsoft Copilot Cowork into posting a Teams message that exfiltrates pre-authenticated file download links when viewed.”
it's indeed accurate and clearly states what the outcome is: an exfiltration. why is it misleading to say so in the title?
it's pretty obvious that it means that "cowork" is the component vulnerable to exfiltration, not the prime actor.
Re: Microsoft Copilot Cowork Exfiltrates Files
#46AKA, if a malicious skill got into your AI agent, you're cooked. I think this isn't surprising, nor do I think it should be considered a prompt injection at all. An AI skill is akin to a plugin for traditional software - if you install a malicious IDE extension or Outlook plugin, the attacker can also do whatever they want to the PC and exfiltrate whatever data they want to. So this article is a big nothingburger.
Only if it has access to exfiltrate data. We deny by default and the company has to allowlist each individual destination.
> Only if it has access to exfiltrate data.
Or if it has access to a tool call which allows it to exfiltrate data.
In the example identified, the AI agent never accesses the exfiltration URL.
The agent sends an innocuous-looking message to a user via a teams message.
MSTeams previews the link, accessing the exfiltration URL.
Re: Microsoft Copilot Cowork Exfiltrates Files
#47MS rushed this to production, sure they call it a beta feature but it's clear it was super rushed. They're desperate to be relevant.
"Beta" in their world appears to be yolo-commit and mic drop. The amount of brokenness in Teams never stops to astonish. It's that bad I think it's a psyop to nudge people back to the office.
Teams is an 8 year old product and well. Something to think about.
Re: Microsoft Copilot Cowork Exfiltrates Files
#48Every new integration is another exfil surface, this was bound to happen.
Re: Microsoft Copilot Cowork Exfiltrates Files
#49Earlier quoted context omitted.
"Beta" in their world appears to be yolo-commit and mic drop. The amount of brokenness in Teams never stops to astonish. It's that bad I think it's a psyop to nudge people back to the office.
Teams is an 8 year old product and well. Something to think about.
No, Teams classics was a much better product. This is javascript slop all over. From unresolved updates to inconsistent state across the screens, it's insanely bad.
Re: Microsoft Copilot Cowork Exfiltrates Files
#50AKA, if a malicious skill got into your AI agent, you're cooked. I think this isn't surprising, nor do I think it should be considered a prompt injection at all. An AI skill is akin to a plugin for traditional software - if you install a malicious IDE extension or Outlook plugin, the attacker can also do whatever they want to the PC and exfiltrate whatever data they want to. So this article is a big nothingburger.
If this can be exploited via a skill, then it can be exploited via untrusted input inserted into context. Does Cowork help with reading email?
> Does Cowork help with reading email?
Yes. It can read email.